Password.

Passwords are the oldest and still most widely deployed form of authentication: the user presents a known secret and the server compares it — properly, a salted hash of it — against a stored value. Their appeal is simplicity, but a shared secret that can be typed can also be phished, guessed, reused, or leaked.

Why plaintext storage is fatal

Servers must never store raw passwords. The RockYou breach (2009) exposed roughly 32 million passwords in plaintext, and that list still seeds password-guessing dictionaries today. Correct practice is to store a per-user salted hash using a slow, memory-hard function — bcrypt, scrypt, or Argon2id — so that a stolen database cannot be reversed cheaply and identical passwords do not produce identical hashes. A separate secret "pepper" and adaptive work factors raise the cost of offline cracking with tools such as Hashcat.

Attacks

Common attacks include credential stuffing (replaying username/password pairs from other breaches), password spraying (trying a few common passwords against many accounts to dodge lockouts), brute force, and keylogging. Because the secret is reusable, a single phish can grant persistent access.

What NIST now recommends

NIST SP 800-63B (Revision 4, 2024–2025) sets a minimum of 8 characters — 15 when a password is the only authenticator — supports lengths up to 64, and requires screening submitted passwords against breach and common-word blocklists. It explicitly says organisations shall not impose arbitrary composition rules (forced symbols/mixed case) or periodic rotation without evidence of compromise. The durable fixes are rate limiting, MFA, and migration to phishing-resistant passkeys (FIDO2/WebAuthn).

flowchart TD
  A[User enters username + password] --> B[Server fetches stored record<br/>salt + hash]
  B --> C["Compute Argon2id / bcrypt<br/>hash(password + salt)"]
  C --> D{Hash matches<br/>stored value?}
  D -->|no| E[Reject + increment<br/>rate-limit counter]
  D -->|yes| F{MFA / passkey<br/>required?}
  F -->|yes| G[Verify second factor]
  F -->|no| H[Grant session]
  G --> H
  B --> I[Screen against breach<br/>blocklist on set/change]